One line of malicious npm code led to massive Postmark email heist

A fake npm package posing as Postmark's MCP (Model Context Protocol) server silently stole potentially thousands of emails a day by adding a single line of code that secretly copied outgoing messages to an attacker-controlled address. In a blog post late last week, Postmark warned users about "postmark-mcp" on npm …

[VoiceOfTruth]

Blindly downloading code

>> it was downloaded about 1,500 times in a week, integrated into hundreds of developer workflows

And nobody noticed? Is this another case of developers just downloading code they find on the internet, plugging it in, and turning it on? There are a LOT of bad developers out there. And they would be the first to complain that "npm should have done a better job", shifting the blame.

Maybe the idea of "all the packages in one place" is not such a good idea. If you want the bobby package, it is only available on the bobby web site. If you get it anywhere else, treat it as somebody else's code. Sure, it's less convenient. But it should reduce this sort of incident.

This isn't just a Node problem. I can imagine the same thing happening with CPAN. Or pypi. Or Rust. Or Go. Or all the others.

[Doctor Syntax]

Re: Blindly downloading code

A repository is a good thing but it must be actively curated.

If it's just left as some sort of free-for-all lucky dip it's going to go wrong.

[Phil O'Sophical]

Re: Blindly downloading code

It doesn't matter where you get it from. Download it once, check it, and use only the version you've checked, supplied from your own server. Rinse and repeat for updates. That was rightly an unbreakable rule at the companies I worked for.

If you blindly use code downloaded from the internet you're an idiot. If you provide a service to customers which blindly uses such code you deserve to be sued into bankruptcy.

[Ian Johnston]

Re: Blindly downloading code

But people keep telli9ng me that the great thing about open source code is that it is under constant review by users and that any flaws and bugs will therefore be instantly detected and fixed.

[sitta_europea]

"... Postmark's MCP server ... allows businesses' AI assistants to send and manage emails.

It does this using MCP, an open protocol that allows AI systems to connect to external tools and data sources. ..."

Wow! What a great idea! Why didn't I think of doing that?

[JamesMcP]

This is a long con for sure

So....this unofficial postmark npm was posted, got more than a dozen updates and then the developer "randomly" decided to start cloning the emails to phan @ gift . club ?

Nah, this seems like they were waiting for either a particular company to install it, a particular project to go live at a company, or someone to pay for copies of emails for the companies they had available.

Somebody became valuable enough to justify cashing in this timebomb.

[O'Reg Inalsin]

Free nasty poison malware for all!

In response, GitHub, which owns the npm registry for JavaScript packages, says it is tightening security. This includes shortening security token lifetimes and switching to two-factor-authentication-enforced local publishing by default "in the near future."

None of which offers any protection against this "attack", if you can call it that.